We’ve grown our incident response team. Here’s what that should tell you.
What is happening
In the past month, our incident response team has handled as many cases as it would in a typical three years. And the pace has not let up.
Our Security Operations Centre is seeing the same pattern: a sharp rise in confirmed incidents across the organisations we monitor. We have grown the incident response team to keep up.
This is not just an Icelandic story. We are seeing the same rise across the countries we work in, and our team has responded to incidents abroad as well as at home.
When the numbers first jumped, it looked like it might be a blip. Weeks later, it clearly is not. Here is what we are seeing, and what we believe every organisation should take from it.
What we noticed
There is no single campaign behind it. The attacks are coming through different doors, at different organisations, in different sectors.
That matters. It means this is not something you can wait out by patching one product or blocking one sender. It is a broader shift: more attackers, trying more ways in, more often.
Attackers have more help than ever, and AI is part of that.
But in our experience, the outcome rarely depends on how clever the attack is. It comes down to two things: whether someone was watching, and whether they knew what to do next.
Two stories from the past month
You don't need to look far to see how quickly things move now.
In October, the open-source PHP project shipped an emergency patch for two critical flaws, known as php2shell, in the language behind a significant share of the web. Researchers had found them with the help of AI. Within 45 minutes of the news getting out, exploit attempts were already in the tens of thousands.
Also in October, attackers raised the temperature of fridges and freezers in hundreds of French supermarkets to 50°C overnight, spoiling food and causing fires. The refrigeration controllers were reachable from the internet and running outdated firmware. This week, similar incidents have been reported in stores in Belgium, Luxembourg and Sweden.
Neither story is about exotic hacking. One is about speed: the gap between a flaw becoming public and attackers using it is now measured in minutes. The other is about the systems nobody thinks of as IT, connected to the internet and left without updates.
Questions worth asking tonight
Forget the headlines for a moment. If an attacker got into your network tonight, these are the questions that would decide how your week goes.
Who would notice, and how fast? Not in theory. Who, by name, would see the alert at 3am on a Saturday, and what would they do next?
Do you know what you have exposed to the internet? You can't defend what you don't know you have. It is common to find systems nobody remembered were still running.
Who do you call, and is it written down? In the middle of an incident, nobody wants to be searching for a phone number or arguing about who decides what.
When did you last test any of this? A plan that has never been tried is a hope, not a plan.
If any of these made you hesitate, you're not alone. That hesitation is exactly what attackers count on.
What to do this week
None of this is new. That is the point. The basics still decide most outcomes.
If you do nothing else this week, do these six things.
- Find out what you have exposed. List every system reachable from the internet. Patch it within days, not weeks, or switch it off.
- Turn on multi-factor authentication everywhere. Start with email, remote access and admin accounts.
- Make sure someone is watching. Your own team or a partner, but someone, including nights and weekends.
- Write a one-page incident plan. Who decides, who you call, and how you reach each other if email is down.
- Test your backups. Restore something. Make sure the backups are separated from the rest of your network.
- Talk to your people. A convincing email or phone call is still one of the easiest ways in.
The bottom line
Attacks are getting cheaper and faster to run. That will not reverse. What you control is how ready you are when one reaches you.
If you want a second opinion on where you stand, or you are dealing with an incident right now, email us at syndis@syndis.com or get in touch through our contact page.